gh0strat | ee5289ff295c8d2116038e4a5a465d64566b31473f8bb20f579863e38b96354c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ee5289ff295c8d2116038e4a5a465d64566b31473f8bb20f579863e38b96354c
Size

108KB
MD5

5fb1f01a3b09548330379e8017c76dac
SHA1

aa688b7dc2da5b5c104218f30ca66094b50caba2
SHA256

ee5289ff295c8d2116038e4a5a465d64566b31473f8bb20f579863e38b96354c
SHA512

c15f03f7cd06d45268c017f25eb3c47ccdb77da53488f8261cb2ccc65d06edfef20c2e8785da12bad450d07f28c7647e184d7d57b4c95d35ed0fe356bdc099d3
SSDEEP

3072:uByBTEGr7VsuRh/DBiE/8bNJFXZccx+tJd/:0yBTEMV1LDw5N3JccqJd/

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

ee5289ff295c8d2116038e4a5a465d64566b31473f8bb20f579863e38b96354c
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

ServiceMain

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.Silvana
Size: 336B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ